The previous chapter is what the work is, measured from 5,197 postings. This one is what it pays and how you get hired — and it comes with a warning attached, because security compensation data is unusually bad.

Two things that table tells you which the numbers themselves do not. GRC pays less than engineering at every band — consistently, across sources, which makes it the more believable finding. And the spread inside a band exceeds the gap between bands, which means where you work matters more than how long you have worked.

The honest answer is that nobody has measured it, and the reason is structural.

The professional body behind CISSP publishes self-reported global medians by credential — CISSP around $127,000, with its governance and architecture credentials higher. It gives no breakdown by role, region or sample size, and it does not claim causation. Secondary sources convert this into ‘CISSP raises your salary 10–25%’, which the primary source does not say.

Which does not make certifications worthless — it makes them a different tool. Their real function is passing a screening filter: a recruiter with 300 applications and a keyword list. That is a genuine, mechanical benefit, and it is a different claim from ‘this will raise your salary’. Buy it for the filter, not for the premium.

What follows is selected for recurrence across sources rather than completeness — and the cross-role patterns at the end are worth more than any individual question.

• SOC and detection. A phishing alert — headers first (authentication results, return-path against reply-to), then sandboxed link and attachment, then blast radius. Failed logins followed by one success from an unusual location — treat as compromise until proven otherwise. Suspicious PowerShell — read the actual command line and get parent-process context before forming a verdict. Ransomware is the single most recurring scenario across every source.
• Application security. SAST against DAST against SCA — asked almost everywhere. The OWASP Top 10, where a strong answer treats it as prioritisation, not recitation. A zero-day in a dependency — answered as a miniature incident response: blast radius, patch availability, compensating control, communicate, patch, review.
• Cloud security. The shared responsibility model, asked nearly universally. Least privilege across multiple clouds — and the reason it is hard is that the three providers' identity models do not share a model without a federation layer.
• GRC and audit. Inherent against residual risk — a fast disqualifier if you blur them. Mapping one control set across NIST, ISO 27001 and SOC 2 simultaneously. Evidence quality — logs and configuration exports against screenshots and self-attestation. All covered in risk and controls.
• Incident response. Ransomware again, and the trap: strong candidates state explicitly that the decision to pay is an executive and legal call, never an analyst's. Implying unilateral authority is the most commonly flagged wrong answer. Volatile-evidence ordering — memory and network before disk — underlies nearly every scenario.
• Architecture. A STRIDE walkthrough applied to a concrete system, not recited as letters. And the reported grading pattern: reward naming the specific trade-off a control introduces — cost, latency, friction — over naming the control. Textbook control-naming is repeatedly flagged as the wrong register for a senior interview.

And a 2026-specific shift worth preparing for. Interviewers now probe how you triage after an automated summariser has swept the obvious alerts. The bar moved from ‘can you read a log’ to ‘can you handle the tenth that automation could not resolve’ — which is consistent with what the previous chapter measured about the entry-level pipeline narrowing.

Behavioural answers are expected in the situation-task-action-result structure everywhere, and the result is specifically graded for being quantified and tied to a business outcome. ‘We fixed it’ scores badly; ‘mean time to contain went from six hours to forty minutes’ does not.